feat(rbac): add RBAC service and API routers

Author: jordan-umusu

alembic/versions/e9e6b74db881_add_rbac_tables.py

@@ -279,6 +279,88 @@ def upgrade() -> None:
         ),
         sa.PrimaryKeyConstraint("role_id", "scope_id", name=op.f("pk_role_scope")),
     )
+    op.create_table(
+        "user_role_assignment",
+        sa.Column("id", sa.UUID(), nullable=False),
+        sa.Column("organization_id", sa.UUID(), nullable=False),
+        sa.Column("user_id", sa.UUID(), nullable=False),
+        sa.Column("workspace_id", sa.UUID(), nullable=True),
+        sa.Column("role_id", sa.UUID(), nullable=False),
+        sa.Column(
+            "assigned_at",
+            sa.TIMESTAMP(timezone=True),
+            server_default=sa.text("now()"),
+            nullable=False,
+        ),
+        sa.Column("assigned_by", sa.UUID(), nullable=True),
+        sa.ForeignKeyConstraint(
+            ["assigned_by"],
+            ["user.id"],
+            name=op.f("fk_user_role_assignment_assigned_by_user"),
+            ondelete="SET NULL",
+        ),
+        sa.ForeignKeyConstraint(
+            ["organization_id"],
+            ["organization.id"],
+            name=op.f("fk_user_role_assignment_organization_id_organization"),
+            ondelete="CASCADE",
+        ),
+        sa.ForeignKeyConstraint(
+            ["role_id"],
+            ["role.id"],
+            name=op.f("fk_user_role_assignment_role_id_role"),
+            ondelete="RESTRICT",
+        ),
+        sa.ForeignKeyConstraint(
+            ["user_id"],
+            ["user.id"],
+            name=op.f("fk_user_role_assignment_user_id_user"),
+            ondelete="CASCADE",
+        ),
+        sa.ForeignKeyConstraint(
+            ["workspace_id"],
+            ["workspace.id"],
+            name=op.f("fk_user_role_assignment_workspace_id_workspace"),
+            ondelete="CASCADE",
+        ),
+        sa.PrimaryKeyConstraint("id", name=op.f("pk_user_role_assignment")),
+        sa.UniqueConstraint(
+            "user_id",
+            "workspace_id",
+            name=op.f("uq_user_role_assignment_user_id_workspace_id"),
+        ),
+    )
+    op.create_index(
+        op.f("ix_user_role_assignment_organization_id"),
+        "user_role_assignment",
+        ["organization_id"],
+        unique=False,
+    )
+    op.create_index(
+        op.f("ix_user_role_assignment_role_id"),
+        "user_role_assignment",
+        ["role_id"],
+        unique=False,
+    )
+    op.create_index(
+        op.f("ix_user_role_assignment_user_id"),
+        "user_role_assignment",
+        ["user_id"],
+        unique=False,
+    )
+    op.create_index(
+        "ix_user_role_assignment_user_org_unique",
+        "user_role_assignment",
+        ["user_id"],
+        unique=True,
+        postgresql_where=sa.text("workspace_id IS NULL"),
+    )
+    op.create_index(
+        op.f("ix_user_role_assignment_workspace_id"),
+        "user_role_assignment",
+        ["workspace_id"],
+        unique=False,
+    )
     op.sync_enum_values(  # type: ignore[attr-defined]
         enum_schema="public",
         enum_name="workspacerole",
@@ -318,6 +400,28 @@ def downgrade() -> None:
         ],
         enum_values_to_rename=[],
     )
+    op.drop_index(
+        op.f("ix_user_role_assignment_workspace_id"),
+        table_name="user_role_assignment",
+    )
+    op.drop_index(
+        "ix_user_role_assignment_user_org_unique",
+        table_name="user_role_assignment",
+        postgresql_where=sa.text("workspace_id IS NULL"),
+    )
+    op.drop_index(
+        op.f("ix_user_role_assignment_user_id"),
+        table_name="user_role_assignment",
+    )
+    op.drop_index(
+        op.f("ix_user_role_assignment_role_id"),
+        table_name="user_role_assignment",
+    )
+    op.drop_index(
+        op.f("ix_user_role_assignment_organization_id"),
+        table_name="user_role_assignment",
+    )
+    op.drop_table("user_role_assignment")
     op.drop_table("role_scope")
     op.drop_table("group_member")
     op.drop_index(